After a bit of reading about the details, formatting of messages, and security of SMTP servers, I found the answer I was looking for here. It looks like a small sacrifice has to be made in masking the sender's email address, and just using the site email address - but this was fine for me, and it works.